GCVE - cpe:2.3:a:simmeth:lieferantenmanager:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:simmeth:lieferantenmanager:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Simmeth (`b4fe0165-8609-57ed-9869-11362d218262`)
Product	Lieferantenmanager (`bd7b469b-238b-5cac-85d0-c68927a32efb`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-44017`	vulnerable	2026-06-08 05:49:35.241203	Details available An issue was discovered in Simmeth Lieferantenmanager before 5.6. Due to errors in session management, an attacker can log back into a victim's account after the victim logged out - /LMS/LM/#main can be used for this. This is due to the credentials not being cleaned from the local storage after logout. Published: 2022-12-25T00:00:00.000Z Updated: 2025-04-15T13:23:41.989Z Open on db.gcve.eu Reference links https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-44016`	vulnerable	2026-06-08 05:49:35.240779	Details available An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can download arbitrary files from the web server by abusing an API call: /DS/LM_API/api/ConfigurationService/GetImages with an '"ImagesPath":"C:\\"' value. Published: 2022-12-25T00:00:00.000Z Updated: 2025-04-15T13:24:40.972Z Open on db.gcve.eu Reference links https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-44015`	vulnerable	2026-06-08 05:49:35.240235	Details available An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can inject raw SQL queries. By activating MSSQL features, the attacker is able to execute arbitrary commands on the MSSQL server via the xp_cmdshell extended procedure. Published: 2022-12-25T00:00:00.000Z Updated: 2025-04-15T13:28:50.226Z Open on db.gcve.eu Reference links https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-44014`	vulnerable	2026-06-08 05:49:35.239769	Details available An issue was discovered in Simmeth Lieferantenmanager before 5.6. In the design of the API, a user is inherently able to fetch arbitrary SQL tables. This leaks all user passwords and MSSQL hashes via /DS/LM_API/api/SelectionService/GetPaggedTab. Published: 2022-12-25T00:00:00.000Z Updated: 2025-04-15T13:30:10.052Z Open on db.gcve.eu Reference links https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-44013`	vulnerable	2026-06-08 05:49:35.239295	Details available An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can make various API calls without authentication because the password in a Credential Object is not checked. Published: 2022-12-25T00:00:00.000Z Updated: 2025-04-15T13:30:53.809Z Open on db.gcve.eu Reference links https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-simmeth-system-gmbh-lieferantenmanager/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-44012`	vulnerable	2026-06-08 05:49:35.238649	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Lieferantenmanager

Notes

PURL mappings

Vulnerability references

Contribute